The IP2Location Country Blocker plugin for WordPress suffers from improper authorization (CWE-285) in all versions up to 2.38.8. Specifically, the admin_init() function lacks proper capability checks, enabling unauthenticated attackers to access and view the plugin's settings. This vulnerability is classified as a Regular Information Exposure, potentially leaking sensitive configuration data. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, no privileges required, no user interaction, and high confidentiality impact. There is no indication of an official patch or vendor advisory providing remediation at this time.

An unauthenticated attacker can view the IP2Location Country Blocker plugin's settings, potentially exposing sensitive configuration information. This could aid attackers in planning further attacks or bypassing geo-blocking controls. There is no evidence of impact on integrity or availability, and no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to WordPress administration interfaces and consider disabling or removing the plugin if not essential. Monitor official vendor channels for updates or patches addressing this vulnerability.